Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-7383

Core API support for multi-value RDN and End Entity Profile validation of multi-value RDNs

    Details

    • Type: New Feature
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: EJBCA 7.0.0
    • Component/s: None
    • Labels:
      None
    • Sprint:
      EJBCA Team Alice - 2018 w45, EJBCA Team Alice - 2018 w48

      Description

      Ability to add/edit end entities and issue certificates with multi-value RDNs. This issue is limited to the ability to do so through the internal APIs.

      In order for this to be safe, validation of this is needed in the End Entity profile validation.

      The multi-value RDNs we know we need to handle are:

      • CN+UID
      • CN+serialNumber
      • DirectoryName+givenName+serialNumber+surname=Ciaffi

      Suggested validation in EE profile:

      • Flag to allow multi-value RDN for fields
        • If multi value RDN is in input and it's not allowed, throw exception
        • If multi value RDN has other fields than CN, UID, serialNumber, dn, givenName, surName, throw exception (only allow a limited set to keep it safe)
      • If allowed, the different parts of the multi-value RDN should be validated against the fields in the EE profile
        • I.e. If we enter "CN=Tomas+UID=123" the EE profile needs to have a CN field, with multi value RDN allowed, and it need to have a UID field. Validation of CN and UID will be as defined in the fields in the EE profile

      Includes:

      • system tests (CertToolsTest, EE profile validation test, X509 CA issuing test)
        • make sure it is not possible to use multi-value RDN by default, as it was not supported before it should be disabled by default now.

       

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                tomas Tomas Gustavsson
                Reporter:
                tomas Tomas Gustavsson
                Verified by:
                Mike Agrenius Kushner
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 1 week Original Estimate - 1 week
                  1w
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 1 week, 2 hours, 15 minutes
                  1w 2h 15m